Mastodawn

BobDaHacker 🏳️‍⚧️

⚽ New Blog Post: I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.

Registered on FIFA's public Agent Platform, got added to their Entra tenant, and accessed the Streaming Management panel for every live World Cup 2026 match. RTMP ingest URLs, stream keys, all five camera angles. Confirmed live in VLC. An attacker could have replaced live camera feeds on TV worldwide.

Full writeup: https://bobdahacker.com/blog/fifa-hack

#InfoSec #BugBounty #ResponsibleDisclosure #FIFA #WorldCup #Security #CyberSecurity #RTMP #BrokenAccessControl

I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.

How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.

@bobdahacker blimey, that was quick (and evidently quite stressful).

Client-side JWT Auth for the win 😬

Debora Weber-Wulff 1d ago

@bobdahacker
Now I'm wide awake! FIFA is this unprofessional? Great hack description, nice training material for interns. Maybe FIFA has another peace prize for you :}

@bobdahacker @ryansingel I’m sorry, but I can’t believe you gave us up and let us down.

@bobdahacker fucking spectacular

Buttered Jorts 1d ago

@bobdahacker @jerry PoC or GTFO ;)

@bobdahacker Great write-up. Thanks for sharing.

Stumpy The Mutt 1d ago

@bobdahacker All of a sudden I remembered the scene near the end of Bill and Ted's Bogus Journey where the bad guy takes over all the TVs in the world and just scowls at the camera...

Simon newslttrs.com 1d ago

@bobdahacker FIFA’s state of the art security:

chinstonwurchill 1d ago

@bobdahacker If true, its criminal that he didnt.

Justin Azoff 1d ago

@bobdahacker
Brilliant writeup, so glad I read this, you covered everything, good concise style too - with jokes! 🙏🏻😊
If I was FIFA I would hire you to give all my systems a once over - what have they got to lose (they already embarrassed themselves). 😊

Marika@sleep 1d ago

@bobdahacker fsociety broadcasting messages to the public on live TV doesn't seem that made up anymore

Torge Rosendahl 1d ago

@bobdahacker This is insane. Amazing find and a very well written blog post!

@bobdahacker You have a lot of courage to go after Fifa from Japan. All it takes is one butthurt person and you're in jail. Fifa are powerful people and safe disclosure etc isn't as common here as in the west. US law doesn't apply in Japan

@bobdahacker It doesn't make sense that these are supposed to be the TV broadcast streams.
On every comparable event those feeds never touch the public internet. I would think that the stadiums are connected to the broadcast center via dark fiber or something similar. Same with the connection to the national broadcasters (although some connections still go out via satellite).

BobDaHacker 🏳️‍⚧️3h ago

@n I get the skepticism but the PGM feed I pulled up in VLC was the full broadcast output with FIFA's graphics overlay, scoreboard, match clock, everything. That's not a low quality ancillary feed for agents to watch. And MediaKind is literally a broadcast distribution platform, that's their entire product. The RTMP ingest goes into MediaKind and then gets packaged out to broadcast partners via HLS and other protocols. The stadiums don't need dark fiber directly to every national broadcaster, that's what MediaKind is for. It sits between the stadium feeds and the TV networks. That is the product. That's what they do.

@bobdahacker I'm sure they're sending out more than five camera angles.
It's a 4K production with Dolby Atmos etc. Do you really think that they use RTMP streams, encoded with something like H.264 or H.265, sent to some random Azure box?
That is all very unlikely. I looks to me that these are lower quality ancillary cameras and feeds, exclusively for that Agent Portal.

BobDaHacker 🏳️‍⚧️3h ago

@n There are definitely more than five camera angles at the stadium, I never said there weren't. Most of the cameras aren't even owned by FIFA, they're operated by broadcast partners. These five on the Streaming Management panel are FIFA's own cameras. Four of them (Tactical, Camera1, High Behind Left, High Behind Right) are cameras FIFA can move, and the PGM feed is the one where they switch between cameras at will and add the broadcast graphics overlay. All five had RTMP ingest URLs on the panel. Also RTMP supports 4K just fine, Enhanced RTMP handles H.265/HEVC. There's no resolution cap on the protocol.

@bobdahacker Yes, I am aware, but it just doesn't look like actual broadcast infrastructure.

BobDaHacker 🏳️‍⚧️3h ago

@n
Fair enough, we can agree to disagree. But MediaKind literally describes itself as providing "end-to-end video delivery solutions" for "broadcasters" running on "cloud-native solutions" MediaKind . Their broadcast page says they deliver "thousands of live events and billions of streams every year." MediaKind The NBA literally invested in MediaKind because they power NBA League Pass streaming The Sports Playmaker . This is what they do. They sit between live event production and distribution to viewers and TV networks. It doesn't have to "look like" traditional broadcast infrastructure because cloud-based distribution is how this stuff works now. The IBC article you linked kind of proves my point, the people there are producing the PGM feed, switching cameras, adding graphics, managing scores. That produced output has to go somewhere for distribution, and that's what MediaKind handles.

Company - MediaKind

MediaKind

@bobdahacker You've probably been to the website for the IBC. https://inside.fifa.com/organisation/president/news/world-cup-2026-international-broadcast-centre-dallas-gianni-infantino
That looks like totally different level of operation.
At the last Olympic Games they had to use ST 2110 infrastructure, because traditional SDI routers 'only' go up to around 512x512 sources.

FIFA World Cup 2026™ International Broadcast Centre opens in Dallas

FIFA President Gianni Infantino has hailed the FIFA World Cup 2026™ International Broadcast Centre (IBC) in Dallas as "absolutely incredible" as the state-of-the-art facility was officially inaugurated at the Kay Bailey Hutchison Convention Centre.

BobDaHacker 🏳️‍⚧️3h ago

@n Yeah the IBC is a massive operation, nobody's disputing that. But the IBC and MediaKind aren't mutually exclusive. The IBC handles on-site production and routing between broadcasters at the venue, MediaKind handles cloud-based distribution. These five feeds I found aren't replacing the IBC's ST 2110 infrastructure, they're part of how FIFA distributes feeds through the cloud. The PGM feed had the full broadcast overlay. I watched it live in VLC. It's all in the blog post with screenshots. Also not really here to argue about this, you've pinged me three times now, I'd recommend just reading the full writeup.

@bobdahacker I've read it and I pinged you three times, because I ran out of characters, not because I desperately need to be right on this.
And if there was any info from FIFA etc. we wouldn't even need to discuss this.